Malicious PDF — malware analysis report

Static analysis result for SHA-256 11e543fdbb2e1dc4…

MALICIOUS

PDF

43.9 KB Created: 2018-12-14 20:38:53 +03:00 Authoring application: pdfTeX-1.40.14 (via Revision 5)
MD5: 310f4dcfdfebebc7272f1683d8eb3077 SHA-1: d11f703e121bfcb8f30de2367920b43791d8a3e8 SHA-256: 11e543fdbb2e1dc4861fafeb37c8925919e754967d80b67d30b6e0dec69c2cd7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine rankings or to distribute a large volume of content, potentially malicious. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-barter-system.pdf
    • http://www.gorillawalker.com/theory-and-algorithms-for-linear-optimization-an-interior-point-approach.pdf
    • http://www.gorillawalker.com/the-war-below-the-story-of-three-submarines-that-battled.pdf
    • http://www.gorillawalker.com/volcanoes-geography-starts-here.pdf
    • http://www.gorillawalker.com/he-ka-ao-no-hauwahine-laua-o-meheanu-a-bilingual.pdf
    • http://www.gorillawalker.com/high-yield-tm-neuroanatomy-high-yield-series-4th-fourth-by.pdf
    • http://www.gorillawalker.com/wiley-cpaexcel-exam-review-spring-2014-study-guide-business-environment.pdf
    • http://www.gorillawalker.com/ross-sea-ecology-italiantartide-expeditions-1987-1995.pdf
    • http://www.gorillawalker.com/existence-theorems-for-ordinary-differential-equations-dover-books-on-mathematics.pdf
    • http://www.gorillawalker.com/room-full-of-mirrors-a-biography-of-jimi-hendrix.pdf
    • http://www.gorillawalker.com/toxic-exposures-contested-illnesses-and-the-environmental-health-movement.pdf
    • http://www.gorillawalker.com/never-go-back-a-jack-reacher-novel.pdf
    • http://www.gorillawalker.com/essentials-of-psychological-testing.pdf
    • http://www.gorillawalker.com/muslim-reformers-in-iran-and-turkey-the-paradox-of-moderation.pdf
    • http://www.gorillawalker.com/hebraic-perspectives.pdf
    • http://www.gorillawalker.com/the-voyage-of-the-jeannette-the-ship-and-ice-journals.pdf
    • http://www.gorillawalker.com/get-the-diagnosis-right-assessment-and-treatment-selection-for-mental.pdf
    • http://www.gorillawalker.com/literature-of-the-global-age-a-critical-study-of-transcultural.pdf
    • http://www.gorillawalker.com/ancient-egyptian-religion-an-interpretation-cloister-library.pdf
    • http://www.gorillawalker.com/kennedy-era-un-estorbo-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/raising-teens-with-diabetes-a-survival-guide-for-parents.pdf
    • http://www.gorillawalker.com/fractal-time-the-secret-of-2012-and-a-new-world.pdf
    • http://www.gorillawalker.com/jim-beam-bottles-1971-72-identification-and-price-guide.pdf
    • http://www.gorillawalker.com/social-entrepreneurship-what-everyone-needs-to-know.pdf
    • http://www.gorillawalker.com/nanoscale-thermoelectrics-lecture-notes-in-nanoscale-science-and-technology.pdf
    • http://www.gorillawalker.com/aaa-north-central-tourbook-iowa-minnesota-nebraska-north-dakota-south.pdf
    • http://www.gorillawalker.com/local-history-collections-in-libraries.pdf
    • http://www.gorillawalker.com/floriated-ornament.pdf
    • http://www.gorillawalker.com/nancy-chandler-s-map-of-bangkok-25th-edition.pdf
    • http://www.gorillawalker.com/elizabeth-bowen-the-shadow-across-the-page.pdf
    • http://www.gorillawalker.com/tuyona-wedding-festive.pdf
    • http://www.gorillawalker.com/the-blues-melody-lyrics-chords-paperback-songs.pdf
    • http://www.gorillawalker.com/citizen-centered-municipal-service-delivery-harnessing-information-technology-to-co.pdf
    • http://www.gorillawalker.com/dk-illustrated-oxford-dictionary.pdf
    • http://www.gorillawalker.com/concepts-in-solids-lectures-on-the-theory-of-solids-lecture.pdf
    • http://www.gorillawalker.com/by-jean-jacques-machado-the-grappler-s-handbook-vol-1.pdf
    • http://www.gorillawalker.com/penetration-testing-with-perl-kindle-edition.pdf
    • http://www.gorillawalker.com/fighter-aircraft-of-world-wars-i-and-ii-an-illustrated.pdf
    • http://www.gorillawalker.com/manhood-and-masculine-identity-in-william-shakespeare-s-the-tragedy.pdf
    • http://www.gorillawalker.com/the-opera-ghost-unraveled.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.